Data Preservation




Online Security



Go through your password manager and see if you're re-using passwords across multiple accounts, or should add 2FA to any accounts. Maybe 2FA is newly supported on some account that didn't have it before.

If you have a PIN on your phone account, to prevent SIM-swapping, call your provider again and try to make a change, and see if they actually do ask for the PIN.

Check that auto-updating is working for your operating system, browsers, anti-virus, VPN. Are you using just about the newest version of each ? Check that updates have not changed privacy settings back to defaults.

If your Android phone is old and not getting updated any more, consider buying a new phone, or flashing a custom ROM (not easy; see Android Custom ROMs section of my Android page).

Is your ISP updating your router's firmware ? You may have to write down the current version and check every 6 months or so.

For each of your simpler devices (TV, IP camera, printer), do some internet searches for "exploit/vulnerability/hack/problem MANUFACTURERNAME model NNN".



Virus / Malware



When was the last time you ran an anti-virus scan ?

See my Anti-Malware page



Accounts





Check your status in a bank-account-monitoring service:
ChexSystems' "Consumer Disclosure"
LexisNexis' "Accurint Individual Access Program"
[I requested my LexisNexis report. 42 pages, much of it repetitive. It showed 2/3 of the addresses I've lived at, and one address that was wrong. A boat that I had owned, but none of the cars I owned. None of my bank accounts or my credit card. Nothing about school or employment history.]
[Sent an opt-out request to LexisNexis, and got a response (paraphrased): "Your request is approved and in process. Note that your info will remain in the following services: restricted public records products available to commercial and govt entities that meet credential requirements and are used to detect and prevent fraud, enforce transactions, perform due diligence and other critical business and govt functions; products regulated by the Fair Credit Reporting Act, third-party data available through real-time gateways; news; legal documents."]



Network and Device Security



Test browser and your computer's network configuration

+/- Linux Security's "Security Tools"
See "Security Testing" section of my "Linux Controls" page



How to tell if you've been hacked

+/-
In general, look for changes or suspicious activity (past and present) in your devices, your network, your online accounts, and your offline accounts. A lot of work. And it's more likely to be some software bug or network hiccup than to be a hacker.

Ahead of time: set up your important accounts to notify you of any security changes or financial transactions. Then: don't ignore those messages.

Have you received any strange messages about password resets or new accounts created ? Are you unable to do a password reset, or to get emails or SMSs from some site ? Also think back: have you done anything risky or unusual recently ?

Look first for simple mistakes. Is the password-reset email ending up in the Spam folder ? Did you misspell your email address or give the wrong phone number to a site ?

Check email accounts carefully. Are you able to log in ? Has anyone added blocking or filtering or forwarding rules, or a new alias, or a new folder, or a special "application password" for another email client ? What is in the Sent, Spam, Trash folders ? Do you have 2FA enabled ? Do you use the same password anywhere else ?

Look at login/access histories on your machines and accounts. Some sites have a "logout all devices that are logged in right now" button.

Check the lists of apps installed on your computer or phone. Check the lists of third-party apps with access to your online (Facebook, email) accounts. Check the lists of add-ons in your browsers. Any that you weren't aware of ?

Sometimes, the damage will be obvious: most files deleted, or files encrypted and names changed to something like "filename.lock" and you get a ransomware note.

WikiHow's "How to Know if You've Been Hacked"
FDSD's "Indicators of Account Compromise"
Adam Levin's "How To Tell If You've Been Hacked (And What To Do About It)"
Pixel Privacy's "How to Tell If You Have Been Hacked"
Cale Hunt's "How to tell if your PC has been hacked"
Roger A. Grimes's "15 signs you've been hacked"
Lorenzo Franceschi-Bicchierai's "How to tell if your online accounts have been hacked"
All Things Secured's "How to Check if Your iPhone is Hacked"

TechIncidents' "Penetration Testing Cheat Sheet For Windows Machine - Intrusion Detection"
SANS Institute's "SCORE Security Checklist" (PDF)
meirwah's "awesome-incident-response"
How-To Geek's "How to See What Web Sites Your Computer is Secretly Connecting To"

General tools for analyzing what's happening in Windows:
Microsoft's "Windows Sysinternals"
Sandro Villinger's "5 ways to see what's going on in your Windows server system right now"
Mark Russinovich's "TCPView"
The PC Security Channel's "How to tell if your PC is Hacked? Process Forensics" (video)

For Linux, see "Monitor what's happening in your system" section of my "Using Linux" page

Micah Lee's "It's Impossible to Prove Your Laptop Hasn't Been Hacked. I Spent Two Years Finding Out."


If ransomware, ID Ransomware



What to do if you've been hacked

+/-
What was hacked and how was it hacked ? This is key. If hacked through password re-use, that tells you one set of things to do (password manager, change passwords, enable 2FA on key accounts). If it was a SIM-swap (phone number stolen), that says do another set of things (get phone number back, check other accounts with that number, maybe change number, put PIN on the support account at your phone-provider). If through malware on your device, that says do another set of things (malware scans, install anti-virus, check that software is updated, maybe re-install whole system, stop downloading dodgy stuff).

If the damage to your system is clear and not really targeted, maybe just cleaning (with malware remover and AV) and scanning is good enough. If damage is extensive, probably factory-reset and re-install the whole system. If you were targeted by someone sophisticated or determined, maybe sell the system and buy a complete new one.

FDSD's "Indicators of Account Compromise"
All Things Secured's "You've Been Hacked!? Here's What You Need to Do"
Leo Notenboom's "Email Hacked? 7 Things You Need to Do NOW"
Leo Notenboom's "Facebook Hacked? What You Need to Do NOW"

If ransomware, isolate the machine and do backups before trying any decryptors; some supposed decryptors are malicious.



What to do if your data is in a data breach

+/-
What data was revealed, and where else is it used ? Where can it be used to attack you ? Can it be used to guess things such as passwords or answers to security questions ?

For example, if your email address and hashed password and phone number are in a data breach, maybe someone will try to hijack your phone number and then try your email address and password on various services, to see if they can log in. This is why you should use different username and password on each account.

Of the data revealed, what parts can you change ? If your credit-card info is revealed, maybe ask your CC company for a new number, or use privacy.com. I think even ID numbers such as passport or driver's license can be changed if you say they were in a breach, or just report the document as stolen.



Port scanning and router testing

+/-

First, deliberately create a suspicious situation

+/-
To deliberately create an open port on your computer (to see if your testing catches it), on Linux run "netcat -4 -k -l -v PORTNUM" (IPv4 TCP) or "netcat -6 -k -l -u -v PORTNUM" (IPv6 UDP) or similar. Use port number 22 (SSH) or 80 (HTTP) if it should be closed in your system; that open port should be caught by any tester.

You could log into the administration page of your router and temporarily enable something bad, such as PnP. Just don't forget to turn it off again later.

Testing network (mainly router) from WAN side

+/-
Usually you run a browser on your machine, access one of these web sites, and then the site server tries to get into your home network using your IP address.

Turn off your VPN to use these.


Also, you could set up a machine somewhere on the public internet to test your network (mainly, router) from the WAN side.

From StackExchange's "Best way to test my home network from the outside":
+/- If you decide to perform a scan from the Internet you may want to give your ISP a heads-up to avoid any trouble.

I run scans on my home IP from a Linode account [virtual Linux box on a cloud service]. Any VPS that doesn't filter your outbound traffic should work (just make sure it doesn't violate your TOS).

First run a full scan against your home IP address. Expect to find only the ports you know you have explicitly opened open. Expect everything else to be "filtered".

Then verify that it is your home router that is performing the filtering and not your ISP. To do this, open a port on your router and rerun the scan. Expect that the port you have opened is detected as open by your scanner. If you find that you still see this port as filtered, then your ISP may be blocking that port. If so, this isn't necessarily a problem, but it means that the previous test didn't test your router, it tested the network connection to your router. Don't forget to disable the port when you're done.

If you want to test your router in isolation, and your router isn't built in to the modem, then you can test it as follows:
  1. Disconnect the router from your modem. (Where "modem" is whatever device connects from your LAN to your ISP's network.)

  2. Connect a second computer to the WAN port on the router. Configure this computer with a static IP address that is independent of the LAN addresses used by your router.

  3. You may need to turn on a DHCP server on the second computer so that the router's WAN interface gets an IP address as usual.

  4. Perform the scans described above from the second computer.


Your ISP may intercept inbound-from-internet traffic to some ports (maybe 53 and 123) on your router and handle it specially, so it never gets to your router. This is to prevent UDP amplification attacks.

Testing router from inside (LAN side)

+/-
You run a browser or other app on your machine, and try to access ports on the LAN side of your router, from across the LAN.

Assuming router's LAN IP address is 192.168.0.1:

These should give 404 or nothing or "unable to connect" or login page:
192.168.0.1/HNAP1
192.168.0.1/cgi-in/config.exp
192.168.0.1/cgi-bin/export_debug_msg.exp
192.168.0.1/cgi/ cgi_status.js
192.168.0.1/ BRS_netgear_success.html
192.168.0.1/ /cgi-bin/;echo$IFS'Vulnerable'
192.168.0.1:32764 (backdoor on some routers)
192.168.0.1:19541
192.168.0.1:8080
192.168.0.1:8443
192.168.0.1:7547 (TR-069 or CPE WAN Management Protocol (CWMP))
192.168.0.1:23 (Telnet)
192.168.0.1:2323 (Telnet)
192.168.0.1:80 (HTTP)
192.168.0.1:443 (HTTP)
192.168.0.1:443 (HTTPS)

If you have nmap: 

nmap -F 192.168.0.1

# increase verbosity level, aggressive scan, no ping / skip discovery,
# open ports, show reason it's open, probe for service version info,
# use default script, do all ports, address 192.168.0.1
nmap -v -A -Pn --open --reason -sV -sC -p 1-65535 192.168.0.1

# increase verbosity level, no ping / skip discovery,
# open ports, UDP scan, max delay 50ms between probes,
# no retries, do all ports, address 192.168.0.1
sudo nmap -v -Pn --open -sU --max-scan-delay 50ms --max-retries 0 -p 1-65535 192.168.0.1
If TCP port 139 (netbios-ssn) is open outbound, that is to allow "NetBIOS services on MS hosts". Probably best to turn it off, unless you're sure you need it.

If TCP port 445 (microsoft-ds) is open outbound, that is to allow "direct TCP/IP MS Networking access without the need for a NetBIOS layer". Probably best to turn it off, unless you're sure you need it.

Port 1900 is PnP; that should not be open.
Android app: "UPnP Tool" by TJ App.

If TCP port 5060 (SIP) is open outbound, probably that is to allow VoIP or video-conferencing, such as Zoom. Probably okay in the outbound direction ?

For other open ports, do internet searches to find out what they're used for.

Depending on open ports, you could try: 

ftp -v 192.168.0.1
ssh -v admin@192.168.0.1
ssh -v root@192.168.0.1
ssh -v Root@192.168.0.1
telnet 192.168.0.1
If test from LAN side gives suspicious results, go to previous section and investigate from WAN side.

Testing IPv6 from LAN side

+/-
Your PC's IPv6 localhost address: [::1]
Same address written fully: [0000:0000:0000:0000:0000:0000:0000:0001]
Real IPv6 address on public internet: [2600::] (Sprint)

There is no standard IPv6 LAN address for the router, equivalent to 192.168.0.1 in IPv4. IPv6 addresses on your LAN are used on the WAN too, so your router's IPv6 address has to be assigned by your ISP.

IPv6 addresses starting with FC00 or FD00 are LAN-only.

Depending on your /etc/hosts file, IPv6 names may include: ip6-localhost, ip6-loopback, ip6-allnodes, ip6-allrouters, or similar starting with "ipv6-" instead of "ip6-". Try "ping6" or "ping -6" to them.

If you have nmap: 

# not sure these are right, I have IPv6 disabled so I can't test them !

# IPv6, increase verbosity level, aggressive scan, no ping / skip discovery,
# open ports, show reason it's open, no DNS resolution, probe for service version info,
# use default script, do all ports, address ::1
nmap -6 -v -A -Pn --open --reason -n -sV -sC -p 1-65535 ::1

# IPv6, increase verbosity level, no ping / skip discovery,
# open ports, UDP scan, max delay 50ms between probes,
# no retries, no DNS resolution, do all ports, address ::1
sudo nmap -6 -v -Pn --open -sU --max-scan-delay 50ms --max-retries 0 -n -p 1-65535 ::1

Android apps to test network (clients and router) from LAN side

+/-
You run one of these apps on your smartphone, and use it to scan your LAN for vulnerable machines or open ports.



PC applications to test network (clients and router) from LAN side

+/-
You run one of these apps on your PC, and use it to scan your LAN for vulnerable machines or open ports.

ssh-audit

PC applications to beat on a single device (client or router)

+/-
You run one of these apps on your PC, and give it the LAN IP address of a single machine you want to attack.

Peter Gervase's "Pen testing with Linux security tools"

Browser to test a single device

+/-
Testing webcam / security camera from inside (LAN side)
+/-
Assuming camera's LAN IP address is 192.168.0.100:

192.168.0.100 /err.htm
192.168.0.100:10554
192.168.0.100:81
192.168.0.100:23 (Telnet)
192.168.0.100:2323 (Telnet)
192.168.0.100

If test from LAN side gives suspicious results, investigate from WAN side.

Testing networked printer from inside (LAN side)
+/-
Assuming printer's LAN IP address is 192.168.0.100:

192.168.0.100:23 (Telnet)
192.168.0.100:2323 (Telnet)
192.168.0.100
Probably ports 9100, 631, 515 will be open on the LAN side; this is normal. But they shouldn't be exposed on the WAN side.

If test from LAN side gives suspicious results, investigate from WAN side.




Lee Munson's "Penetration testing for the home computer user"
TechIncidents' "Penetration Testing Checklist with Android, windows, Apple & Blackberry Phones"
Online Tech Tips' "How to Scan Your Network for Devices and Open Ports"
SpiceWork's thread "How can I pen test my own network?" (more about business networks)
Router Security's "Test Your Router" (also cameras, printers, etc)
Paul Wagenseil's "Your Router's Security Stinks: Here's How to Fix It"
Sergio Prado's "Reverse engineering my router's firmware with binwalk"



Online Privacy



Test

+/-
  • From Rob Pegoraro's "How to make your offline self harder to find online":
    Open an incognito window in your browser (so Google or any other search engine shows what a stranger would see) and search for your name and street address, name and phone number, name and birthday, and name and last four digits of your Social Security number.

    Note that, individually, each data point may not look like a huge privacy risk - but combining them can unlock various other databases.


  • See how much of your info is publicly exposed:
    PublicRecordsNow
    Radaris
    The Paranoid's Bible: An anti-dox effort


  • Have a friend try to find your address, your email address, your Facebook info, etc online.

    Gasmask (Linux only)
    If you use reddit: SnoopSnoo (but hangs on FF, and last update 2015)


  • Pay a company to test your privacy and security.


Minimize the number of things you use

+/-
Do you really need to use:
  • Each add-on you have installed in your browser ?
  • Each app you have installed on your phone ?
  • Each app you have installed on your computer ?
  • Each app you have allowed to access your Facebook account ?
  • Each app you have allowed to access your email account ?
  • Each social media site you use ?
Every one of these is potential point of failure, a thing that could be stealing and selling your data, or accidentally having a security vulnerability.



Painful things: Maybe every few years, change your email address, phone, phone number, credit card number ? Maybe do a factory-reset of your phone, or a fresh OS install on your computer ? Change to a different internet service provider (ISP) ?



Review my Computer Security and Privacy page and see if you can make some improvements in various areas.



Do a periodic check and cleanup



Idea for a Security Scanner app:
+/-
Linux needs a simple standard Security Scanner application or dialog. This is intended to improve the experiences of new users, reduce security breaches for all users, and avoid blaming the distro or "Linux" for what really was a configuration mistake. It should be a standard thing in all distros and DEs.

The app/dialog would do a very quick scan of your system, report any sensitive apps or conditions, and suggest that you check their settings to make sure they're secure and updated and as desired.


For example:
+/-
Security Scan
  • Applications:
    • Remote-control apps (Teamviewer, VNC, X2Go, AnyDesk, NoMachine, etc).
    • Apps that backup/sync to somewhere else (Dropbox etc).
    • Apps/services that handle incoming traffic (web server etc).
    • Repositories you are using.

  • Networking:
    • Ports that have listeners.
    • Network file-shares.
    • VPN on or off.
    • Port-based firewall on or off.
    • Application-based firewall on or off.
    • SELinux/Firejail/AppArmor on or off.
    • IPv6 is enabled, the address is/isn't link-local, address is/isn't derived from MAC address.
    • DNS server is N.N.N.N, which means corporation X can see what domains you're accessing.
    • Is DNSoverTLS being used ? https://wiki.archlinux.org/title/Systemd-resolved#DNS_over_TLS
    • Is DNSSEC validation being used ? https://wiki.archlinux.org/title/Systemd-resolved#DNSSEC

  • Devices:
    • The webcam currently is being used by application X.
    • The microphone currently is being used by application X.
    • CPU mitigations on or off.
    • Output of "fwupdmgr security --force"
    • Output of "sudo fwupdtool security --force"
    • Link to devices firmware-security applet, if any.

  • Accounts:
    • Accounts that can log in via password.
    • Accounts that have no password.
    • Is auto-login (no password) enabled ?
    • SSH daemon running ?

  • Resources:
    • Your system disk has less than 10% free space remaining.
    • Your RAM plus swap has less than 10% free space remaining.
    • Your SSD has less than 10% of its estimated lifetime remaining.

  • Advice:
    • Ask user: are you using a password manager ? You should.
    • Ask user: are you using two-factor authentication on important online accounts (email, financial) ? You should.
    • Ask user: do you have backups of important files ? You should.
    • It been N days since last update.
    • Your disk is not encrypted, so someone who steals your system could read your data.

  • Privacy:
    • Location services are enabled / disabled.
    • Telemetry (e.g. popularity-contest, census, popcon, collectd, pkgstats, gnome-info-connect, ubuntu-report, kuserfeedback-bin, sosreport) is on or off.

Further tests you could do:
  • See GNOME's Device Security settings module (link).
  • Install a large security-scanner application (e.g. OpenVAS).


You might even find things you forgot were installed, or you never knew were installed or active.

Probably should be a module under System Settings / Security, maybe called "Security Scan". That would keep it a standard part of the system, well-maintained, in a known place, maybe able to link to other settings applets, maybe linked-to by a Welcome app, able to have links to documentation. Some of the items are distro-specific or DE-specific, so best to keep this as part of the distro or DE.

This is not intended to compete with major apps such as OpenVAS or commands such as cvescan. It should be as simple and clear as possible.

Behind the scenes, I'd like to have this based on a shell script file, so a knowledgeable and privileged user, or a distro or DE maintainer, or corporate IT person, could modify it to add/change/delete items without doing C or C++ coding. The Settings module (C or C++) will call a shell script which does the work and then produces a Markdown file, which the module (C or C++) then displays. Is there any existing System Settings module that is similar to this one ?

Started creating the shell script: SecurityScan.sh
Sample output (reports bash and others as placeholders): SecurityScan.md
Now a GitHub repo


In Linux, related commands: 

EGREPLIST='vnc|^vino|x2go|remmina|tftp-server|telnet-server|rsh-server|xinetd|^rclone|^rsync|dropbox|megasync|^sshd|^xrdp|odrive|nextcloud|^xpra|vinagre|krfb|nomachine|teamviewer|anydesk|guacamole-server|guacd|gnome-user-share|mate-user-share|vsftpd|^samba/|^apache2/|^httpd/|^nginx|^lighttpd/|openssh-*server'
apt list | grep -i -E ${EGREPLIST} | grep installed
dnf list --installed | grep -i -E ${EGREPLIST}
eopkg list-installed | grep -i -E ${EGREPLIST}

# If you find a "suspicious" apt/deb package:
apt show PKGNAME
dnf info PKGNAME
ls -l /var/lib/dpkg/info/PKGNAME.list 	# see when installed
dnf history | grep PKGNAME			 	# see when installed
grep PKGNAME /var/log/yum.log*			# see when installed
sudo grep PKGNAME /var/log/zypp/history	# see when installed

snap list | grep -i -E ${EGREPLIST}
# If you find a "suspicious" snap image:
snap info IMGNAME

flatpak list | grep -i -E ${EGREPLIST}

sudo docker image ls | grep -i -E ${EGREPLIST}

sudo ps -eo comm | grep -i -E ${EGREPLIST} | grep -v grep

# Some specific apps:
xpra list
xpra info

lsmod | grep -i '^nfs'



Miscellaneous